﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;

namespace ConsoleApp5
{
    /// <summary>
    /// 导入表函数名结构
    /// </summary>
    struct ImportByName
    {
        public UInt16 Hint;
        public string Name;

    }
    /// <summary>
    /// x32导入表-块结构
    /// </summary>
    [StructLayout(LayoutKind.Explicit, Pack = 1)]
    struct ThunkData
    {
        [FieldOffset(0x00)] public Int32 ForwarderString;     // function name import
        [FieldOffset(0x00)] public Int32 Function;            // if bound IAT, pointer to function address
        [FieldOffset(0x00)] public Int32 Ordinal;             // ordinal import 
        [FieldOffset(0x00)] public Int32 AddressOfData;       // if bound IAT, pointer to data
    }
    /// <summary>
    /// 导入表结构
    /// </summary>
    [StructLayout(LayoutKind.Explicit, Pack = 1)]
    partial struct ImportDescriptor
    {
        [FieldOffset(0x00)] public Int32 Characteristics;      // 0 for terminating null import descriptor
        [FieldOffset(0x00)] public Int32 OriginalFirstThunk;   // Rva to ThunkData
        [FieldOffset(0x04)] public Int32 TimeDataStamp;        // 0 if not bound, -1 if bound。
        [FieldOffset(0x08)] public Int32 ForwarderChain;       // -1 if no forwarders。
        [FieldOffset(0x0c)] public Int32 Name;                 // dll name
        [FieldOffset(0x10)] public Int32 FirstThunk;           // if bound this IAT has actual addresses
    }
}
